Merge branch 'winwarnings' of https://github.com/dechamps/tinc into 1.1

diff --git a/doc/tinc.conf.5.in b/doc/tinc.conf.5.in
index 771a25fe96aacda94c4fa1bcb867ce6b45ad5423..9d9bf76f7d04440118cb8fcb1b9396bcca91201e 100644 (file)
--- a/doc/tinc.conf.5.in
+++ b/doc/tinc.conf.5.in
@@ -121,6 +121,8 @@ will automatically set up meta connections to other nodes,
 without requiring
 .Va ConnectTo
 variables.
+.Pp
+Note: it is not possible to connect to nodes using zero (system-assigned) ports in this way.
 .It Va BindToAddress Li = Ar address Op Ar port
 This is the same as
 .Va ListenAddress ,
@@ -340,6 +342,14 @@ To only listen on a specific port but not on a specific address, use
 .Li *
 for the
 .Ar address .
+.Pp
+If
+.Ar port
+is set to zero, it will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. In this case it is recommended to set
+.Va AddressFamily
+as well, otherwise
+.Nm tinc
+will assign different ports to different address families but other nodes can only know of one.
 .It Va LocalDiscovery Li = yes | no Pq yes
 When enabled,
 .Nm tinc
@@ -549,6 +559,14 @@ The port number on which this tinc daemon is listening for incoming connections,
 which is used if no port number is specified in an
 .Va Address
 statement.
+.Pp
+If this is set to zero, the port will be randomly assigned by the system. This is useful to randomize source ports of UDP packets, which can improve UDP hole punching reliability. When setting
+.Va Port
+to zero it is recommended to set
+.Va AddressFamily
+as well, otherwise
+.Nm tinc
+will assign different ports to different address families but other nodes can only know of one.
 .It Va PublicKey Li = Ar key Bq obsolete
 The public RSA key of this tinc daemon.
 It will be used to cryptographically verify it's identity and to set up a secure connection.

diff --git a/src/connection.h b/src/connection.h
index b5d3d18dedcd15d0d22e38e7a5e32ee48a6cbd3a..b74b582ab21a7a0d1ae658cc6db1103532c31a07 100644 (file)
--- a/src/connection.h
+++ b/src/connection.h
@@ -36,7 +36,7 @@
 
 typedef struct connection_status_t {
                unsigned int pinged:1;                  /* sent ping */
-               unsigned int active:1;                  /* 1 if active.. */
+               unsigned int unused_active:1;
                unsigned int connecting:1;              /* 1 if we are waiting for a non-blocking connect() to finish */
                unsigned int unused_termreq:1;          /* the termination of this connection was requested */
                unsigned int remove_unused:1;           /* Set to 1 if you want this connection removed */
@@ -49,7 +49,7 @@ typedef struct connection_status_t {
                unsigned int log:1;                     /* 1 if this is a control connection requesting log dump */
                unsigned int invitation:1;              /* 1 if this is an invitation */
                unsigned int invitation_used:1;         /* 1 if the invitation has been consumed */
-               unsigned int unused:19;
+               unsigned int unused:18;
 } connection_status_t;
 
 #include "ecdsa.h"

diff --git a/src/control.c b/src/control.c
index dc8890a867ef5cf661965c6a45abc23bf2e7144d..98eae804d7cc46b79b0d9448fbadd512d2984618 100644 (file)
--- a/src/control.c
+++ b/src/control.c
@@ -106,7 +106,7 @@ bool control_h(connection_t *c, const char *request) {
                        for list_each(connection_t, other, connection_list) {
                                if(strcmp(other->name, name))
                                        continue;
-                               terminate_connection(other, other->status.active);
+                               terminate_connection(other, other->edge);
                                found = true;
                        }
 

diff --git a/src/invitation.c b/src/invitation.c
index a6996cc692aee9857fc8866b3ce30a7a7c5919c2..28f9f8ce0755468f8c4abea0f9cc07e016011900 100644 (file)
--- a/src/invitation.c
+++ b/src/invitation.c
@@ -613,6 +613,7 @@ make_names:
        FILE *fh = fopen(filename, "w");
        if(!fh) {
                fprintf(stderr, "Could not create file %s: %s\n", filename, strerror(errno));
+               fclose(f);
                return false;
        }
 

diff --git a/src/meta.c b/src/meta.c
index 25cca5f0cfedab824e066613e4e0897aa4ee0281..fbd3e26f160b04e2b74721adb960e818ea33c908 100644 (file)
--- a/src/meta.c
+++ b/src/meta.c
@@ -76,7 +76,7 @@ bool send_meta(connection_t *c, const char *buffer, int length) {
 
 void broadcast_meta(connection_t *from, const char *buffer, int length) {
        for list_each(connection_t, c, connection_list)
-               if(c != from && c->status.active)
+               if(c != from && c->edge)
                        send_meta(c, buffer, length);
 }
 

diff --git a/src/net.c b/src/net.c
index 8fe3c516c14d08646ffad222a4bce8edb116c5e0..91b93056e44c1573a7f4eef6f71a01fb8687bfe7 100644 (file)
--- a/src/net.c
+++ b/src/net.c
@@ -97,8 +97,6 @@ void purge(void) {
 void terminate_connection(connection_t *c, bool report) {
        logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Closing connection with %s (%s)", c->name, c->hostname);
 
-       c->status.active = false;
-
        if(c->node && c->node->connection == c)
                c->node->connection = NULL;
 
@@ -155,7 +153,7 @@ static void timeout_handler(void *data) {
                        continue;
 
                if(c->last_ping_time + pingtimeout <= now.tv_sec) {
-                       if(c->status.active) {
+                       if(c->edge) {
                                if(c->status.pinged) {
                                        logger(DEBUG_CONNECTIONS, LOG_INFO, "%s (%s) didn't respond to PING in %ld seconds", c->name, c->hostname, (long)now.tv_sec - c->last_ping_time);
                                } else if(c->last_ping_time + pinginterval <= now.tv_sec) {
@@ -170,7 +168,7 @@ static void timeout_handler(void *data) {
                                else
                                        logger(DEBUG_CONNECTIONS, LOG_WARNING, "Timeout from %s (%s) during authentication", c->name, c->hostname);
                        }
-                       terminate_connection(c, c->status.active);
+                       terminate_connection(c, c->edge);
                }
        }
 
@@ -204,7 +202,7 @@ static void periodic_handler(void *data) {
                /* Count number of active connections */
                int nc = 0;
                for list_each(connection_t, c, connection_list) {
-                       if(c->status.active && !c->status.control)
+                       if(c->edge)
                                nc++;
                }
 
@@ -251,7 +249,7 @@ static void periodic_handler(void *data) {
                        int i = 0;
 
                        for list_each(connection_t, c, connection_list) {
-                               if(!c->status.active || c->status.control)
+                               if(!c->edge)
                                        continue;
 
                                if(i++ != r)
@@ -263,7 +261,7 @@ static void periodic_handler(void *data) {
                                logger(DEBUG_CONNECTIONS, LOG_INFO, "Autodisconnecting from %s", c->name);
                                list_delete(outgoing_list, c->outgoing);
                                c->outgoing = NULL;
-                               terminate_connection(c, c->status.active);
+                               terminate_connection(c, c->edge);
                                break;
                        }
                }
@@ -293,7 +291,7 @@ static void periodic_handler(void *data) {
 
 void handle_meta_connection_data(connection_t *c) {
        if (!receive_meta(c)) {
-               terminate_connection(c, c->status.active);
+               terminate_connection(c, c->edge);
                return;
        }
 }
@@ -418,7 +416,7 @@ int reload_configuration(void) {
                struct stat s;
                if(stat(fname, &s) || s.st_mtime > last_config_check) {
                        logger(DEBUG_CONNECTIONS, LOG_INFO, "Host config file of %s has been changed", c->name);
-                       terminate_connection(c, c->status.active);
+                       terminate_connection(c, c->edge);
                }
                free(fname);
        }

diff --git a/src/net_packet.c b/src/net_packet.c
index b7ef5193f73b38517a5c4b060c41c57a5ce45521..4ec70fa6b935e6a6f8e6aa490bb39fceb6358e95 100644 (file)
--- a/src/net_packet.c
+++ b/src/net_packet.c
@@ -360,7 +360,6 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        vpn_packet_t pkt1, pkt2;
        vpn_packet_t *pkt[] = { &pkt1, &pkt2, &pkt1, &pkt2 };
        int nextpkt = 0;
-       vpn_packet_t *outpkt = pkt[0];
        size_t outlen;
 
        if(n->status.sptps) {
@@ -402,7 +401,7 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        /* Decrypt the packet */
 
        if(cipher_active(n->incipher)) {
-               outpkt = pkt[nextpkt++];
+               vpn_packet_t *outpkt = pkt[nextpkt++];
                outlen = MAXSIZE;
 
                if(!cipher_decrypt(n->incipher, &inpkt->seqno, inpkt->len, &outpkt->seqno, &outlen, true)) {
@@ -459,7 +458,7 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
        length_t origlen = inpkt->len;
 
        if(n->incompression) {
-               outpkt = pkt[nextpkt++];
+               vpn_packet_t *outpkt = pkt[nextpkt++];
 
                if((outpkt->len = uncompress_packet(outpkt->data, inpkt->data, inpkt->len, n->incompression)) < 0) {
                        logger(DEBUG_TRAFFIC, LOG_ERR, "Error while uncompressing packet from %s (%s)",
@@ -769,12 +768,12 @@ bool send_sptps_data(void *handle, uint8_t type, const char *data, size_t len) {
 
        /* Otherwise, send the packet via UDP */
 
-       const sockaddr_t *sa;
+       const sockaddr_t *sa = NULL;
        int sock;
 
        if(to->status.send_locally)
                choose_local_address(to, &sa, &sock);
-       else
+       if(!sa)
                choose_udp_address(to, &sa, &sock);
 
        if(sendto(listen_socket[sock].udp.fd, data, len, 0, &sa->sa, SALEN(sa->sa)) < 0 && !sockwouldblock(sockerrno)) {
@@ -937,7 +936,7 @@ void broadcast_packet(const node_t *from, vpn_packet_t *packet) {
                // usually distributes the sending of broadcast packets over all nodes.
                case BMODE_MST:
                        for list_each(connection_t, c, connection_list)
-                               if(c->status.active && c->status.mst && c != from->nexthop->connection)
+                               if(c->edge && c->status.mst && c != from->nexthop->connection)
                                        send_packet(c->node, packet);
                        break;
 

diff --git a/src/net_socket.c b/src/net_socket.c
index b2297af4198231dea0f069d116161fb6a2b04f93..1bf9d16afe03588c079af6aad0c9a1946f202369 100644 (file)
--- a/src/net_socket.c
+++ b/src/net_socket.c
@@ -388,7 +388,7 @@ static void handle_meta_write(connection_t *c) {
                        logger(DEBUG_CONNECTIONS, LOG_ERR, "Could not send %d bytes of data to %s (%s): %s", c->outbuf.len - c->outbuf.offset, c->name, c->hostname, sockstrerror(sockerrno));
                }
 
-               terminate_connection(c, c->status.active);
+               terminate_connection(c, c->edge);
                return;
        }
 
@@ -820,7 +820,7 @@ void try_outgoing_connections(void) {
                if(c->outgoing && c->outgoing->timeout == -1) {
                        c->outgoing = NULL;
                        logger(DEBUG_CONNECTIONS, LOG_INFO, "No more outgoing connection to %s", c->name);
-                       terminate_connection(c, c->status.active);
+                       terminate_connection(c, c->edge);
                }
        }
 

diff --git a/src/protocol_auth.c b/src/protocol_auth.c
index 778c607b2ba74f9fb9683b2df3414a375ac41e83..ac486ea6f0ba0b34b12eacc75b66990d45f7391f 100644 (file)
--- a/src/protocol_auth.c
+++ b/src/protocol_auth.c
@@ -805,7 +805,6 @@ bool ack_h(connection_t *c, const char *request) {
        /* Activate this connection */
 
        c->allow_request = ALL;
-       c->status.active = true;
 
        logger(DEBUG_CONNECTIONS, LOG_NOTICE, "Connection with %s (%s) activated", c->name,
                           c->hostname);

diff --git a/src/protocol_key.c b/src/protocol_key.c
index e838f6135578ea8d8dcd3db2dcd6fe14e89e1bc9..fcb748f4ea9ee998d555ac5d8f1c0e8ecd5da333 100644 (file)
--- a/src/protocol_key.c
+++ b/src/protocol_key.c
@@ -41,7 +41,7 @@ void send_key_changed(void) {
        /* Immediately send new keys to directly connected nodes to keep UDP mappings alive */
 
        for list_each(connection_t, c, connection_list)
-               if(c->status.active && c->node && c->node->status.reachable && !c->node->status.sptps)
+               if(c->edge && c->node && c->node->status.reachable && !c->node->status.sptps)
                        send_ans_key(c->node);
 
        /* Force key exchange for connections using SPTPS */

diff --git a/src/route.c b/src/route.c
index 8c65c4c14c7d2828fdef79740bcda70c432f5147..17f1c71a18e13b4f14e988d45e27a4f7f5ef8f16 100644 (file)
--- a/src/route.c
+++ b/src/route.c
@@ -203,7 +203,7 @@ static void age_subnets(void *data) {
                        }
 
                        for list_each(connection_t, c, connection_list)
-                               if(c->status.active)
+                               if(c->edge)
                                        send_del_subnet(c, s);
 
                        subnet_del(myself, s);
@@ -238,7 +238,7 @@ static void learn_mac(mac_t *address) {
                /* And tell all other tinc daemons it's our MAC */
 
                for list_each(connection_t, c, connection_list)
-                       if(c->status.active)
+                       if(c->edge)
                                send_add_subnet(c, subnet);
 
                timeout_add(&age_subnets_timeout, age_subnets, NULL, &(struct timeval){10, rand() % 100000});

diff --git a/src/sptps.c b/src/sptps.c
index 3fbd8540e88dccc27256718dfc5c539cb6841aaa..e9ce94aef85ef361a706de4322a1117d5475160e 100644 (file)
--- a/src/sptps.c
+++ b/src/sptps.c
@@ -431,13 +431,12 @@ bool sptps_verify_datagram(sptps_t *s, const char *data, size_t len) {
        uint32_t seqno;
        memcpy(&seqno, data, 4);
        seqno = ntohl(seqno);
+       if (!sptps_check_seqno(s, seqno, false))
+               return false;
 
        char buffer[len];
        size_t outlen;
-       if(!chacha_poly1305_decrypt(s->incipher, seqno, data + 4, len - 4, buffer, &outlen))
-               return false;
-
-       return sptps_check_seqno(s, seqno, false);
+       return chacha_poly1305_decrypt(s->incipher, seqno, data + 4, len - 4, buffer, &outlen);
 }
 
 // Receive incoming data, datagram version.

diff --git a/src/subnet_parse.c b/src/subnet_parse.c
index 1d54c1344746031bcef3e339b5354256de04c5f3..c919b59a8eef028710498f77052ebb894c6ba350 100644 (file)
--- a/src/subnet_parse.c
+++ b/src/subnet_parse.c
@@ -186,6 +186,7 @@ int subnet_compare(const subnet_t *a, const subnet_t *b) {
 bool str2net(subnet_t *subnet, const char *subnetstr) {
        char str[1024];
        strncpy(str, subnetstr, sizeof(str));
+       str[sizeof str - 1] = 0;
        int consumed;
 
        int weight = DEFAULT_WEIGHT;
@@ -255,7 +256,7 @@ bool str2net(subnet_t *subnet, const char *subnetstr) {
                for (int i = 0; i < 4; i++)
                        if (x[i] > 255)
                                return false;
-               sprintf(last_colon, ":%02x%02x:%02x%02x", x[0], x[1], x[2], x[3]);
+               snprintf(last_colon, sizeof str - (last_colon - str), ":%02x%02x:%02x%02x", x[0], x[1], x[2], x[3]);
        }
 
        char* double_colon = strstr(str, "::");